Components with strictly controlled access to the services and/or to the data typically have an architecture formed around the microprocessor and a program memory including the secret key. Such components are used for example in smart cards, especially for banking applications, via a control terminal or remote terminal. Such components use one or more secret key encryption or private key encryption methods to compute an output data from an input data. Such a method is used for example to encipher, decipher, authenticate or sign an input message or else verify the signature of the input message.
To ensure the security of the transactions, the secret key or private key encryption methods are constructed in such a way that it is not possible to determine the secret key used from the knowledge of the input data and/or the output data of the algorithm. However, the security of a component relies on its capacity to keep the secret key that it uses concealed, for this key cannot be modified.
One method frequently used is the DES (Data Encryption Standard) type method. This method can be used for example to give an enciphered message MS (or output data) encoded on 64 bits, from a plaintext message ME (or input data) also encoded on 64 bits, and a secret 56-bit key K0. The main steps of the DES are described in detail with reference to FIG. 1. After an initial permutation IP, the block formed by the permutated bits of the input data is separated into a left-hand part L0 and a right-hand part R0.
After this, 16 rounds of identical operations are performed. During each round of operations, the right-hand part (R0, . . . , R15) of an intermediate data computed during the previous round of operations is combined with a derivative key (M1, . . . , M16) during a transformation called a transformation F. The result of the transformation F is then added (XOR operation) to the left-hand part (L0, . . . , L15) of the intermediate data computed during the previous round of operations.
After the 16th round of operations, the left-hand part L16 and right-hand part R16 of the 16th intermediate data are assembled and a final permutation IP−1, which is the inverse of the initial permutation IP, terminates the procedure. An i-ranking round of operations included between 1 and 16 is described in detail with reference to FIG. 2. The 56 bits of an intermediate key Ki-1 computed during the previous round are shifted (operation Si) to give a new updated intermediate key Ki, then 48 bits out of 56 are selected by an operation PC of permutation/compression to provide a derived key Mi. Mi=PC(Ki)=PC(Si(Ki-1)). The association of the steps PC and Si forms a key computation step ET2.
In parallel, the transformation F is carried out. The right-hand part Ri-1 of a piece of intermediate data computed during the previous round is extended to 48 bits by an expansion (operation E), combined with the derived key M by an XOR type operation, replaced by 32 new bits by a substitution operation (represented by the operation SBOX), then permutated once again (operation P). In practice, the operations F, P, E, PC, SBOX are identical for all the rounds. On the contrary, the operations S1 to S16 used during the computation of the derived keys K1 to K16 are different from one round to another.
All the characteristics of the operations IP, IP−1, P, PC, E, SBOX, Si performed during the implementation of a DES method are known: the computations made, the parameters used, etc. These characteristics are, for example, described in detail in the patent application WO 00/46953 or in the “Data Encryption Standard, FIPS PUB 46”, published on 15th Jan. 1977.
The security of a component using a secret key or private key encryption method lies in its capacity to keep the key that it uses secret. To be secure, a component must be capable especially of keeping concealed the secret key that it uses when it undergoes a DPA (Differential Power Analysis) type analysis. In a DPA analysis, a statistical analysis is made of the consumption of the component, namely the trace left by the component as a function of time. For this purpose, a sample of about 1,000 measurements of traces is used, each trace corresponding to input data ME[i=1 to 1000] that are different and independent with respect to one another. The statistical study validates one or more assumptions made on the value of the bits of the secret key used.
A specific example of the implementation of a DPA type analysis on a component using a DES type encryption method is described in detail in WO 00/46953, especially in pages 3, 4 of this publication. The DES type encryption method is especially vulnerable to the DPA type attacks at the output of the SBOX operators. More generally, an encryption method is vulnerable to a DPA type analysis at any point where the secret key appears in combination either with the input data or with the output data. Thus, in practice, a DES type method is vulnerable to attack at output of all the operators (XOR, P, E, PC, SBOX, etc) of all the rounds of operations because the secret key is mixed with the input data of the first round of operations.
For example, with the input data ME being known, and making assumptions on the secret key K0, it is possible to predict the value of at least one bit of the intermediate data element (L1, R1) given at output of the first round of operations. The prediction is verified, then the assumption made on the secret key is verified.
To be secure, a component must also be capable of keeping the secret key that it uses concealed, when it undergoes an SPA type analysis (Simple Power Analysis). In an SPA analysis, the component is made to execute the encryption method that it uses several times by applying the same input data ME to it, and, for each execution of the method, the trace left by this execution is measured as a function of time. The trace represents, for example, the power consumption of the component or the electromagnetic energy radiated as a function of time. The set of measurements is then averaged to filter the noise from the measurement and obtain the real trace of the circuit for a fixed input data ME. For example, a set of 10 to 1000 identical measurements may be enough to filter the noise from the measurement and obtain the real trace of the component for a fixed input data ME. After filtering, the different steps of the DES method can be seen clearly on the real trace of the component: initial permutation IP, 16 rounds of operations and then final permutation IP-1.
A DES type method is sensitive to SPA type analysIs especially at the points where the secret key appears, in its initial form K0 or in another form (intermediate keys K1, . . . , K16, derived keys M1, . . . , M16). Indeed, by an SPA type analysis it is possible, for each round i of operations, to determine an image of the derived key Mi. For example, it is possible to identify the time interval during which the derived key Mi is transferred before the execution of the XOR operation. Since all the derived keys M1 to M16 are obtained from the secret key K0 by known operations, a knowledge of simple images of the derived keys gives a information on the secret key K0.
In general, all the encryption methods are more or less sensitive to DPA type attacks, especially at the places where there appears a predictable intermediate result that is a combination of the input data (or a data derived from the input data) and of the secret or private key (or of a key obtained from the secret or private key) or else that is a combination of the output data (or a data derived from the input data) and of the secret key (or of a key obtained from the secret key). An intermediate result of this kind is indeed predictable, from the input data and/or from the output data and from assumptions on the key used, because the encryption methods used (the operators used, the order of use of these operators, etc) are known. A DPA attack then gives information on the key used by validating the assumptions made.
In practice, all the methods are sensitive at output of all the operators of all their steps (or sub-steps) using the input data (or a data derived from the input data), once the input data has been mixed with the secret key for a first time. In the same way, all the methods are also sensitive at output of all the operators giving a result that depends on the output data and on the secret or private key, and this is the case once the input data has been mixed for a first time with a secret or private key.
In the same way, all the encryption methods using secret keys are more or less sensitive to SPA type analysis. Their sensitivity is especially great at places where the key appears alone, in its initial form or during a step known as a critical step, during which the secret key is used either directly or in a derived form obtained by a known law of derived key scheduling. A critical step of this kind is for example an intermediate or derived key scheduling step in which the key is computed from a secret or private key or else from a previously computed intermediate key.